Articles

Practical commentary on securities law, exempt market compliance, fund formation, investor reporting, and private capital markets.

How to Respond to an OSC Compliance Review

Nick Wright, BA JD MBA LLM (Tax)

Wright Business Law

Every private fund manager operating in or distributing into Ontario should plan to eventually face a compliance review by the Ontario Securities Commission (OSC) or another Canadian provincial/territorial securities regulator such as the BCSC, ASC, AMF, or MSC. These regulators, collectively the CSA member regulators, conduct examinations under harmonised national rules such as NI 31-103 and NI 45-106. The CSA occasionally publishes joint guidance summarising issues found by its members.

Compliance reviews increasingly focus on fundraising practices, dealer registration exposure, KYC/AML documentation, marketing materials, books and records, oversight of service providers, and whether fund sponsors operate a credible compliance system. How a manager responds to a review is critical. A structured, disciplined response can materially influence the final deficiency report and reduce regulatory risk.

Regulatory Framework & Sources of Law

Compliance reviews are grounded in provincial legislation. In Ontario, the OSC relies on Securities Act (Ontario), s. 20(1), which authorises staff to require production of records and conduct examinations. Equivalent authority exists in every other Canadian jurisdiction through its own securities legislation.

At the national level, NI 31-103 sets out registration obligations and ongoing compliance requirements for registrants; NI 45-106 governs exempt distributions; and NI 81-106 applies to investment funds that are reporting issuers or that are mutual funds in certain contexts. These instruments form the backbone of Canadian compliance expectations.

Provincial regulators and CSA notices summarise common deficiencies surfaced during member regulator reviews. Although not binding, they materially influence how regulators interpret general principles, including governance expectations, conflicts of interest, marketing practices, and the adequacy of books and records.

A compliance review evaluates not only technical rule adherence but also the existence of a functioning compliance program, credible supervision, reasonable policies, and meaningful senior-management oversight.

Definitions & Thresholds

Several definitions determine review scope:

“Registrant” includes registered PMs, EMDs, and IFMs subject to NI 31-103.

“Distribution” under Securities Act (Ontario), s. 1(1) triggers NI 45-106 obligations and Form 45-106F1 filing requirements.

“Trade” and “acts in furtherance of a trade” capture marketing and solicitation activity, which regulators may review closely even for unregistered fund sponsors.

“Permitted client” status under NI 31-103 affects suitability obligations for registrants but does not remove KYC or record-keeping expectations.

Thresholds also influence focus areas. Large assets under management (AUM), frequent closings, high investor counts, cross-border capital raising, or reliance on the offering memorandum (OM) exemption increase the likelihood of a more intensive review. Registrants must retain records for 7 years under NI 31-103, s. 11.5–11.6, and funds using the OM exemption must comply with NI 45-106, s. 2.9(17.10) regarding audited financials.

Application in Practice

A review typically begins with a formal letter from a provincial regulator. The letter outlines the review type (routine, risk-based, or sweep) and includes an initial request list. Registrants may be asked to provide:

  • policies and procedures;
  • KYC documentation;
  • trade records and investment decision files;
  • complaint logs;
  • marketing materials;
  • financial statements;
  • service provider agreements; and
  • governance records.

Exempt-market fund managers, whether registered or not, must provide subscription documents, anti-money-laundering (AML) files, accredited investor verification, evidence supporting NI 45-106 categories, and filing records for Form 45-106F1.

The fund must assemble a response team, typically the CCO, CFO or COO, external counsel, and operations leads. All records must be complete, consistent, and presented in an organised and searchable format.

During fieldwork, regulators scrutinise whether the firm’s documented procedures match actual practices. They test investor files, examine marketing oversight, review conflict-of-interest management, and evaluate the quality of books and records. Credibility and responsiveness matter: evasive or speculative answers can invite deeper scrutiny.

Regulators then issue a draft deficiency letter. This is a critical stage. The firm may provide explanations, evidence, or remediation plans. The quality of this response significantly influences the final report and whether the matter escalates.

Grey Areas & Regulator Focus

A central grey area involves the extent to which unregistered fund managers must meet NI 31-103-level standards. Although NI 31-103 formally applies only to registrants, OSC and other CSA members routinely expect exempt-market fund sponsors to maintain similar standards for KYC/AML, marketing review, and books and records. This expectation is grounded in the regulator’s authority over exempt distributions.

Dealer registration is another major focus. Regulators frequently examine Form 45-106F1 filings to assess whether the sponsor is “in the business” of trading under NI 31-103. Patterns of repeated fundraising, meetings with prospective investors, or active solicitation often lead regulators to question whether exempt market dealer registration is required.

Marketing practices are highly scrutinised. Regulators focus on outdated pitch decks, performance claims lacking substantiation, inconsistent disclosures between offering documents and marketing materials, and selective disclosure of deal pipelines or performance history.

Conflicts of interest, particularly around allocation, related-party transactions, fee structures, and cross-fund interactions, are frequent deficiency areas. Regulators expect written conflict identification, controls, mitigation steps, and documentation of decisions.

Finally, cybersecurity and third-party oversight have emerged as major priorities. Regulators expect documented risk assessments, incident response plans, and oversight of administrators, custodians, and fund accountants.

Interactions with Adjacent Regimes

Compliance reviews routinely expose issues beyond securities rules. Examples include:

  • AML gaps under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) overlapping with NI 31-103 know your client (KYC) issues.
  • Foreign Account Tax Compliance Act (FATCA) / Common Reporting Standard (CRS) deficiencies creating mismatches between investor files and tax compliance.
  • Corporate law weaknesses (e.g., missing GP resolutions or outdated minute books).
  • Privacy law weaknesses under Personal Information Protection and Electronic Documents Act (PIPEDA), especially where investor data security is inadequate.
  • SEDAR+ or OSC portal filings that do not match internal records, prompting questions about filing accuracy or books-and-records quality.

Regulators examine the business holistically. They expect consistency across tax documents, corporate records, subscription agreements, AML files, and securities filings.

Illustrative Scenarios

A private equity fund receives an OSC review request for KYC and exempt distribution documentation. Regulators identify unsupported accredited investor representations and stale KYC files. Several historic distributions risk being treated as non-compliant, requiring remediation, re-verification, and corrected Form 45-106F1 filings.

In another scenario, a venture fund uses pitch decks based on modelled returns. Regulators request substantiation, but the manager cannot produce supporting analysis or risk disclosures. The regulator mandates revised materials and a formal marketing review process.

Lastly, a private credit fund registered as a portfolio manager faces an intensive review. Regulators identify absent investment committee minutes, incomplete trade supervision logs, and insufficient oversight of a third-party administrator. The manager must overhaul its compliance infrastructure and deliver periodic remediation updates.

Compliance Checklist

  • Maintain comprehensive books and records consistent with NI 31-103 standards or equivalent controls.
  • Upon receiving a review letter, assemble a response team.
  • Map regulator requests and assign document owners.
  • Develop a structured response plan with timelines and responsibilities.
  • Review all responsive materials internally for completeness and consistency.
  • Provide factual, concise responses supported by evidence.
  • Respond to draft deficiency letters with a point-by-point reply and remediation commitments, if applicable.
  • Provide documentation showing corrective action taken.
  • Integrate lessons learned into the compliance program and address root causes.

What’s Changing

Regulators across Canada are increasing the frequency and depth of reviews of private fund managers. OSC priorities include marketing conduct, dealer registration exposure, continuous offering practices, cybersecurity governance, and oversight of third-party service providers. CSA initiatives to modernise NI 31-103 may introduce additional requirements for conflicts management, books and records, and digital governance. Ongoing reforms to NI 45-106 may strengthen exempt market data collection, leading to more robust internal documentation practices. As SEDAR+ evolves, regulators may cross-reference filings more easily, amplifying inconsistencies.

Conclusion & Next Steps

Responding effectively to a compliance review by the OSC or another Canadian securities regulator is a critical responsibility for private fund managers. Strong documentation, disciplined planning, and clear communication significantly influence regulator perceptions and outcomes. Compliance reviews are an opportunity to demonstrate governance maturity, identify gaps, and improve systems. Fund sponsors should revisit their compliance framework regularly, enhance internal controls, and prepare their teams so that when a review occurs, they are positioned to respond confidently and competently.

Book a Consultation

If you are preparing for or are responding to a regulatory inquiry for your private investment fund in Canada, contact us to schedule an initial consultation with Nick Wright.

Disclaimer

This article is provided for general informational purposes only and does not constitute legal or professional advice. Reading this article does not create a solicitor–client relationship between you and the author or Wright Business Law. Laws and regulations may vary by jurisdiction and may change over time. Readers should seek qualified legal advice before acting on any information contained herein.